WaveSpeedAI Nano Banana Pro Image Generation/Editing

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 2.0.1

Overview

This is a coherent WaveSpeed image generation skill with disclosed remote uploads and authentication, though its unpinned npm setup deserves caution.

Before installing, understand that this skill uses a paid remote service and uploads prompts plus any selected local images. Install WaveSpeed tooling only from a trusted source, prefer pinned package versions or a project-local locked install, avoid ad hoc npx -y execution when possible, and protect or rotate the stored WaveSpeed credential if you suspect dependency compromise.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned npm Packages Permit Mutable Third-Party Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–25
Vulnerability Type: Unpinned third-party dependencies and automatic remote package execution
Risk Level: Medium

Vulnerable Code

bash

npm install -g @wavespeed/cli
wavespeed login          # opens https://wavespeed.ai/accesskey and stores the key
wavespeed status         # confirms you are signed in

text

Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`).

Technical Analysis

The Skill instructs users or agents to install @wavespeed/cli globally and execute @wavespeed/mcp through npx -y without pinning either package to a reviewed version or verifying package integrity.

npm therefore resolves a mutable package version from the registry at execution time. The npx -y option suppresses installation confirmation and immediately executes downloaded package code. The global installation also makes the CLI broadly available in the user's environment. The project contains no lockfile, integrity hashes, or vendored implementation through which the executed dependency could be independently verified.

There is no evidence that the named packages are currently malicious. The vulnerability is the unsafe dependency acquisition mechanism: a compromised package release, maintainer account, or distribution channel could cause future invocations of these documented commands to execute attacker-controlled code.

Attack Path

1. An attacker compromises the npm publisher account, package repository, release pipeline, or another part of the distribution channel for @wavespeed/cli or @wavespeed/mcp.
2. The attacker publishes a malicious version that is selected by npm's default version resolution.
3. A user or agent follows ...[truncated 1280 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both packages to explicit, reviewed versions, for example:

   bash

   npm install --save-exact @wavespeed/cli@<reviewed-version>
   npx @wavespeed/mcp@<reviewed-version>
   

2. Use a project-local installation rather than a global installation so dependency scope and replacement are easier to control.
3. Commit a lockfile generated from the reviewed dependency graph and use npm ci for reproducible installation.
4. Verify registry provenance and package integrity before execution. Where supported, enforce npm provenance attestations and approved integrity hashes.
5. Remove -y from the npx command so users receive an explicit installation prompt, and require informed confirmation before downloading or executing external packages.
6. Run the CLI or MCP server in a restricted environment with minimal filesystem access, no unrelated secrets, and only the network permissions necessary to reach the declared service.
7. Keep WAVESPEED_API_KEY scoped to the minimum required permissions and rotate it if dependency compromise is suspected.
8. Periodically audit pinned package releases and their transitive dependencies before upgrading.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends executing npx -y @wavespeed/mcp without pinning a specific version, which causes users to fetch and run whatever package version is current at execution time. If the package is compromised, typosquatted, or a malicious update is published, this becomes a direct remote code execution path on the user's machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.